CVE-2026-41389

CVE-2026-41389 is a local-root containment bypass vulnerability affecting OpenClaw versions 2026.4.7 through 2026.4.14. The flaw allows attackers to craft malicious tool-result media references that circumvent path restrictions, enabling unauthorized access to local files and Windows UNC network paths. This could result in disclosure of sensitive data or credential exposure on affected systems. The vulnerability has a CVSS score of 5.8 (Medium) with a network-based attack vector requiring no authentication or user interaction, indicating moderate accessibility. The attack complexity is low and impact is limited to confidentiality breaches with no integrity or availability concerns. The FAUCET risk score of 42.0 reflects the moderate threat level within the broader threat landscape. There is currently no evidence of active exploitation in the wild, as the CVE is not listed on the Known Exploited Vulnerabilities catalog and remains on the inactive Hot List. The EPSS score of 0.0003 indicates very low probability of exploitation relative to other vulnerabilities. Organizations running affected OpenClaw versions should prioritize patching to version 2026.4.15 or later, though immediate emergency response is not warranted given the current low exploitation activity.